During a sprint, developers are responsible for ensuring the expected outcome of a change is thoroughly evaluated for any security impacts. Any impacts must be reported to the team lead. Before…

Risk assessment evaluates potential threats and vulnerabilities at a strategic or project level, but does not produce the specific technical baseline data about current code behavior required before individual sprint-level code changes.

Running regression tests before modifying source code produces a documented baseline of the application's existing behavior and security posture. This pre-change test execution provides concrete data - passing and failing results including security-focused checks - that the developer must report to the team lead. Without this baseline, there is no accurate way to measure or communicate what security impacts a proposed change may introduce.

User story development defines functional requirements and acceptance criteria for features, not a mechanism to evaluate or document the current security state of source code before changes.

Data abstraction is a software design principle that hides implementation details behind interfaces, and is unrelated to evaluating or reporting security impacts of code changes.

Business impact assessment measures the effect of changes on organizational operations and continuity, not the technical security evaluation of source code that must be reported to the team lead before sprint changes.